From 2d47bb7917fa4d8264d0b502d855b971fcb143fa Mon Sep 17 00:00:00 2001 From: Michael Wood Date: Sun, 23 Nov 2014 20:04:54 -0800 Subject: [PATCH] add pg_hba.conf changes --- CONTRIBUTING.md | 6 +- Vagrantfile | 5 +- config/database.yml | 2 +- setup/pg_hba.conf | 99 ++++++++++++++++++++++++++++++ {script => setup}/setup_vagrant.sh | 8 ++- 5 files changed, 113 insertions(+), 7 deletions(-) create mode 100644 setup/pg_hba.conf rename {script => setup}/setup_vagrant.sh (90%) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 16cbdd3e..81d48416 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,6 +1,6 @@ -#Contributing +# Contributing -# Setting Up Development Environment +## Setting Up Development Environment ### 1 Fork and clone the repository. @@ -8,7 +8,7 @@ https://www.vagrantup.com/downloads ### 3 Capture the powers of vagrant - * In the repo dir: vagrant up + * In the repo dir: vagrant up (Safely ignore: 'dpkg-preconfigure: unable to re-open stdin: No such file or directory') * If changes have been made since running vagrant up: vagrant provision * To login to the machine: vagrant ssh diff --git a/Vagrantfile b/Vagrantfile index d207c031..9af219db 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -9,6 +9,7 @@ Vagrant.configure(VAGRANTFILE_API_VERSION) do |config| # Ubuntu 14.04 base box config.vm.box = "ubuntu/trusty64" config.vm.hostname = BOXNAME + #config.vm.box_download_checksum = # Disable automatic box update checking. If you disable this, then # boxes will only be checked for updates when the user runs @@ -26,7 +27,7 @@ Vagrant.configure(VAGRANTFILE_API_VERSION) do |config| # config.ssh.forward_agent = true # Share refuge repo in vagrant home folder - config.vm.synced_folder ".", "/home/vagrant/refugerestrooms" + config.vm.synced_folder ".", "/vagrant/refugerestrooms" # View virtualbox provider docs for more options config.vm.provider "virtualbox" do |vb| @@ -37,7 +38,7 @@ Vagrant.configure(VAGRANTFILE_API_VERSION) do |config| # If this gets bigger I can make it into a chef run # mi-wood - config.vm.provision "shell", path: "script/setup_vagrant.sh", privileged: false + config.vm.provision "shell", path: "setup/setup_vagrant.sh", privileged: false # Enable provisioning with chef solo, specifying a cookbooks path, roles # path, and data_bags path (all relative to this Vagrantfile), and adding diff --git a/config/database.yml b/config/database.yml index ff95246e..1bdf148e 100644 --- a/config/database.yml +++ b/config/database.yml @@ -3,7 +3,7 @@ development: encoding: unicode database: bathrooms_development pool: 5 - host: "" + host: localhost test: adapter: postgresql diff --git a/setup/pg_hba.conf b/setup/pg_hba.conf new file mode 100644 index 00000000..e2e88588 --- /dev/null +++ b/setup/pg_hba.conf @@ -0,0 +1,99 @@ +# PostgreSQL Client Authentication Configuration File +# =================================================== +# +# Refer to the "Client Authentication" section in the PostgreSQL +# documentation for a complete description of this file. A short +# synopsis follows. +# +# This file controls: which hosts are allowed to connect, how clients +# are authenticated, which PostgreSQL user names they can use, which +# databases they can access. Records take one of these forms: +# +# local DATABASE USER METHOD [OPTIONS] +# host DATABASE USER ADDRESS METHOD [OPTIONS] +# hostssl DATABASE USER ADDRESS METHOD [OPTIONS] +# hostnossl DATABASE USER ADDRESS METHOD [OPTIONS] +# +# (The uppercase items must be replaced by actual values.) +# +# The first field is the connection type: "local" is a Unix-domain +# socket, "host" is either a plain or SSL-encrypted TCP/IP socket, +# "hostssl" is an SSL-encrypted TCP/IP socket, and "hostnossl" is a +# plain TCP/IP socket. +# +# DATABASE can be "all", "sameuser", "samerole", "replication", a +# database name, or a comma-separated list thereof. The "all" +# keyword does not match "replication". Access to replication +# must be enabled in a separate record (see example below). +# +# USER can be "all", a user name, a group name prefixed with "+", or a +# comma-separated list thereof. In both the DATABASE and USER fields +# you can also write a file name prefixed with "@" to include names +# from a separate file. +# +# ADDRESS specifies the set of hosts the record matches. It can be a +# host name, or it is made up of an IP address and a CIDR mask that is +# an integer (between 0 and 32 (IPv4) or 128 (IPv6) inclusive) that +# specifies the number of significant bits in the mask. A host name +# that starts with a dot (.) matches a suffix of the actual host name. +# Alternatively, you can write an IP address and netmask in separate +# columns to specify the set of hosts. Instead of a CIDR-address, you +# can write "samehost" to match any of the server's own IP addresses, +# or "samenet" to match any address in any subnet that the server is +# directly connected to. +# +# METHOD can be "trust", "reject", "md5", "password", "gss", "sspi", +# "krb5", "ident", "peer", "pam", "ldap", "radius" or "cert". Note that +# "password" sends passwords in clear text; "md5" is preferred since +# it sends encrypted passwords. +# +# OPTIONS are a set of options for the authentication in the format +# NAME=VALUE. The available options depend on the different +# authentication methods -- refer to the "Client Authentication" +# section in the documentation for a list of which options are +# available for which authentication methods. +# +# Database and user names containing spaces, commas, quotes and other +# special characters must be quoted. Quoting one of the keywords +# "all", "sameuser", "samerole" or "replication" makes the name lose +# its special character, and just match a database or username with +# that name. +# +# This file is read on server startup and when the postmaster receives +# a SIGHUP signal. If you edit the file on a running system, you have +# to SIGHUP the postmaster for the changes to take effect. You can +# use "pg_ctl reload" to do that. + +# Put your actual configuration here +# ---------------------------------- +# +# If you want to allow non-local connections, you need to add more +# "host" records. In that case you will also need to make PostgreSQL +# listen on a non-local interface via the listen_addresses +# configuration parameter, or via the -i or -h command line switches. + + + + +# DO NOT DISABLE! +# If you change this first entry you will need to make sure that the +# database superuser can access the database using some other method. +# Noninteractive access to all databases is required during automatic +# maintenance (custom daily cronjobs, replication, and similar tasks). +# +# Database administrative login by Unix domain socket +local all postgres peer + +# TYPE DATABASE USER ADDRESS METHOD + +# "local" is for Unix domain socket connections only +local all all trust +# IPv4 local connections: +host all all 127.0.0.1/32 trust +# IPv6 local connections: +host all all ::1/128 trust +# Allow replication connections from localhost, by a user with the +# replication privilege. +#local replication postgres peer +#host replication postgres 127.0.0.1/32 md5 +#host replication postgres ::1/128 md5 diff --git a/script/setup_vagrant.sh b/setup/setup_vagrant.sh similarity index 90% rename from script/setup_vagrant.sh rename to setup/setup_vagrant.sh index 5d554e02..499aeb18 100644 --- a/script/setup_vagrant.sh +++ b/setup/setup_vagrant.sh @@ -3,7 +3,7 @@ # It's only tested with ubuntu 14.04 set -e -REFUGE_PATH=$HOME/refugerestrooms +REFUGE_PATH=/vagrant/refugerestrooms # required packages declare -A packages @@ -71,6 +71,12 @@ fi echo 'Running bundle install...' bundle install --gemfile=$REFUGE_PATH/Gemfile +# Change permissions on pg_hba.conf +pg_hba=/etc/postgresql/9.3/main/pg_hba.conf +sudo cp /vagrant/refugerestrooms/setup/pg_hba.conf $pg_hba +sudo chown postgres:postgres $pg_hba +sudo chmod 640 $pg_hba + # Creating postres user if ! psql -c 'SELECT rolname FROM pg_roles;' postgres | grep vagrant; then echo 'Creating vagrant postgres user...'